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Scope 

There are occasions where individuals will ask the ICO to delete or 
to stop processing their personal data under Section 10 of the Data 
Protection Act 1998 (DPA). The purpose of this guidance note is to 
set out the steps to take on receipt of such a request and the 
factors to consider before responding to a request. 


Responsibility 

It is the responsibility of the Information Governance Department - 
Information Access Team to respond to any such requests. All 
requests must be forwarded to them as soon as possible because a 
response must be sent within 21 calendar days of receiving the 
objection. 


Background 

Any individual who wants to exercise this right under the DPA must 
put their objection in writing and state what they require the ICO to 
do to avoid causing damage or distress. The DPA limits the extent 
to which you must comply with such an objection, in the following 
ways: 


e An individual can only object to the ICO processing their own 
personal data. 

e Processing an individual’s personal data must be causing 
unwarranted and substantial damage or distress. 


e The objection must specify why the processing has this effect. 


In addition, an individual has no right to object to processing if: 


e they have consented to the processing; 


e the processing is necessary: 
- in relation to a contract that the individual has entered into; 
or 
- because the individual has asked for something to be done 
so they can enter into a contract; 


e the processing is necessary because of a legal obligation that 
applies to the ICO (other than a contractual obligation); or 
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e the processing is necessary to protect the individual’s “vital 
interests”. 


How to recognise a section 10 request 


It is important to remember that a section 10 request may not be 
easily recognisable. It may not mention section 10 and may form 
part of a lengthy piece of correspondence. It doesn’t have to be 
and in most case won't be, in the form of any formal notice. For 
example it could be a complainant asking for all his case documents 
to be deleted or destroyed, albeit the Act refers to processing not 
deletion. It is important to recognise a request and to forward it to 
the Internal Compliance Department to respond. 


Considerations for the Information Governance 
Department 


Initial considerations when processing a section 10 request 


e Is the request in writing? 

e Does the correspondence set out the reasons why the 
processing of their personal data by the ICO has caused 
damage or distress? If not we need to ask the individual to 
clarify. The damage or distress caused has to be “substantial” 
before the ICO is obliged to comply. 


What is meant by damage or distress 


The DPA does not define what is meant by unwarranted and 
substantial damage or distress. However, in most cases: 


e substantial damage would be financial loss or physical harm; and 


e substantial distress would be a level of upset, emotional or 
mental pain, that goes beyond annoyance, irritation, strong 
dislike, or a feeling that the processing is morally abhorrent. 


Response 

We must respond within 21 days of receiving the objection to 
processing. The response must state what we intend to do and, if 
we do not intend to comply with the objection in some way, give 
reasons for your decision. A record of the decisions you made about 
the factors listed above will help you compose your response. 


Record keeping 
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An ENQ case will be created on CMEH for each section 10 request 
and all correspondence must be held on that case. 


A spreadsheet has been set up to record all requests of this nature. 
Where we do not intend to comply with the objection in some way, 
we will record the reasons for the decision to ensure consistency. 


This policy is the responsibility of the Information Governance 
Department and will be reviewed regularly. 
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